Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,7 @@ working correctly. Some common problems are:
itself to protect a potentially non-development environment.
3. If you are using the [Authorization Plugin](https://github.com/cakephp/authorization)
you need to set `DebugKit.ignoreAuthorization` to `true` in your config.
Not needed anymore for DebugKit 5.3.0+.

## Reporting Issues

Expand Down
3 changes: 2 additions & 1 deletion docs/en/index.rst
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,8 @@ Configuration
// Ignore image paths
Configure::write('DebugKit.ignorePathsPattern', '/\.(jpg|png|gif)$/');

* ``DebugKit.ignoreAuthorization`` - Set to true to ignore Cake Authorization plugin for DebugKit requests. Disabled by default.
* ``DebugKit.ignoreAuthorization`` - Set to true to ignore Cake Authorization plugin for DebugKit requests.
Not needed anymore for DebugKit 5.3.0+.

* ``DebugKit.maxDepth`` - Defines how many levels of nested data should be shown in general for debug output. Default is 5.
WARNING: Increasing the max depth level can lead to an out of memory error.::
Expand Down
2 changes: 1 addition & 1 deletion src/Controller/DebugKitController.php
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ public function beforeFilter(EventInterface $event): void
// ignore it, only if `DebugKit.ignoreAuthorization` is set to true
$authorizationService = $this->getRequest()->getAttribute('authorization');
if ($authorizationService instanceof AuthorizationService) {
if (Configure::read('DebugKit.ignoreAuthorization')) {
if (Configure::read('DebugKit.ignoreAuthorization') !== false) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We had defaulted to off to take care of the inevitable situation of someone deploying with debug on. The hope was that folks wouldn't also deploy this config option.

Copy link
Member Author

@dereuromark dereuromark Nov 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thats highly unlikely, as this is usually a committed config setting then (not a app_local one) :)
So not really protecting anyone here IMO

$authorizationService->skipAuthorization();
} else {
Log::info(
Expand Down
16 changes: 8 additions & 8 deletions tests/TestCase/Controller/DebugKitControllerTest.php
Original file line number Diff line number Diff line change
Expand Up @@ -67,33 +67,33 @@ private function _buildController()
}

/**
* tests authorization is enabled but not ignored
* tests authorization is checked to avoid
* AuthorizationRequiredException throwned
*
* @return void
*/
public function testDontIgnoreAuthorization()
public function testIgnoreAuthorization()
{
$controller = $this->_buildController();
$event = new Event('testing');
$controller->beforeFilter($event);

$this->assertFalse($controller->getRequest()->getAttribute('authorization')->authorizationChecked());
$this->assertTrue($controller->getRequest()->getAttribute('authorization')->authorizationChecked());
}

/**
* tests authorization is checked to avoid
* AuthorizationRequiredException throwned
* tests authorization is enabled but not ignored
*
* @return void
*/
public function testIgnoreAuthorization()
public function testDontIgnoreAuthorization()
{
Configure::write('DebugKit.ignoreAuthorization', true);
Configure::write('DebugKit.ignoreAuthorization', false);

$controller = $this->_buildController();
$event = new Event('testing');
$controller->beforeFilter($event);

$this->assertTrue($controller->getRequest()->getAttribute('authorization')->authorizationChecked());
$this->assertFalse($controller->getRequest()->getAttribute('authorization')->authorizationChecked());
}
}